Microsoft 365 mailbox delegation
A Microsoft 365 mailbox delegate-permission grant (Add-MailboxPermission) giving a principal FullAccess or Send-As on another user's mailbox.
What it detects
A Microsoft 365 mailbox delegate-permission grant (Add-MailboxPermission) giving a principal FullAccess or Send-As on another user's mailbox. Attackers grant themselves standing delegate access to a compromised or targeted mailbox to read and send mail without the owner's password — a post-BEC persistence and email- collection move that survives a credential reset.
MITRE ATT&CK mapping
- T1098.002Account Manipulation: Additional Email Delegate Permissions· Persistence
False positives and triage
Admins and delegation workflows legitimately grant mailbox access (shared mailboxes, executive assistants, migrations). Confirm the grantee is unexpected and correlate with the mailbox owner — FullAccess/SendAs to an unrelated account is the concern, especially added by a non-admin or from an unusual IP.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/cloud/m365_mailbox_delegation.yaml, licensed under the Apache License 2.0.
id: cloud.identity.m365_mailbox_delegation
version: 1.1.0
status: stable
severity: high
confidence: 0.75
platforms: [application]
mitre_techniques: [T1098.002]
description: |
A Microsoft 365 mailbox delegate-permission grant (Add-MailboxPermission) giving a
principal FullAccess or Send-As on another user's mailbox. Attackers grant
themselves standing delegate access to a compromised or targeted mailbox to read
and send mail without the owner's password — a post-BEC persistence and email-
collection move that survives a credential reset.
match:
provider: Office365
event_action_any:
# Exchange splits mailbox delegation across TWO cmdlets, and matching only
# the first missed half the technique: Add-MailboxPermission grants
# FullAccess/ReadPermission, while SendAs is granted by
# Add-RecipientPermission — a different cmdlet, same delegation.
- Add-MailboxPermission
- Add-RecipientPermission
raw_message_contains_any:
- "FullAccess"
- "SendAs"
- "AccessRights=FullAccess"
correlation_keys: [user_name]
false_positive_guidance: |
Admins and delegation workflows legitimately grant mailbox access (shared
mailboxes, executive assistants, migrations). Confirm the grantee is unexpected
and correlate with the mailbox owner — FullAccess/SendAs to an unrelated account
is the concern, especially added by a non-admin or from an unusual IP.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.